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Abstract 
Oh 

This paper investigates generation of a secret key from a reciprocal wireless channel. In particular 
we consider wireless channels that exhibit sparse structure in the wideband regime and the impact of the 
qq ■ sparsity on the secret key capacity. We explore this problem in two steps. First, we study key generation 

from a state-dependent discrete memoryless multiple source. The state of source captures the effect of 
channel sparsity. Secondly, we consider a wireless channel model that captures channel sparsity and 
correlation between the legitimate users' channel and the eavesdropper's channel. Such dependency can 
significantly reduce the secret key capacity. 

According to system delay requirements, two performance measures are considered: (i) ergodic 
secret key capacity and (ii) outage probability. We show that in the wideband regime when a white 
sounding sequence is adopted, a sparser channel can achieve a higher ergodic secret key rate than a 
richer channel can. For outage performance, we show that if the users generate secret keys at a fraction 
of the ergodic capacity, the outage probability will decay exponentially in signal bandwidth. Moreover, 
a larger exponent is achieved by a richer channel. 
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I. Introduction 

The fundamental limit of secret key generation from discrete memoryless multiple source 
(DMMS) is developed by Ahlswede, Csiszar yj] and Maurer [2]. Their results show that if 
X, Y, Z (respectively observed by Alice, Bob and Eve) are correlated with a known distribution, 
it is possible to generate a secret key between Alice and Bob at a positive rate through use of 
a public discussion. The resulting information rate leaked to Eve can be made arbitrarily small. 
The supremum of achievable secret key rates is called the secret key capacity. 

Since their work, there have been many extensions to explore the secret key capacity of more 
complicated models. In yL H{], users observe DMMS and also transmit information via wiretap 
channel [5], but there is no access to public channel for discussion. The authors in consider 
a wiretap channel influenced by a random channel state, known by one (or both) of the legitimate 
users. In such models, the random channel state can be viewed as a kind of correlated source 
shared by transmitter/receiver which also influences the transmission. 

This work has been supported in part by the National Science Foundation under CAREER Grant No. CF-0844539 and Grant 
No. CNS-0627589. 

The authors are with the Dept. of Electrical and Computer Engineering, University of Wisconsin, Madison, WI 53706. E-mail: 
thchou.th@gmail.com, sdraper@ece.wisc.edu, akbar@engr.wisc.edu. 
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In iTToL [Till , key gene ration from DMMS is considered where the DMMS is excited by a 
deterministic source [10] or by a random source [ HQ . This sender-excited model is motivated by 
an application in which key generation is based on the inherent randomness of reciprocal wireless 
channel. Consider a situation where Alice and Bob transmit a sounding signal to each other over 
a reciprocal wireless channel. Due to the channel reciprocity, Alice and Bob observe a pair of 
correlated sources. The source turns out to be a good source for secret key generation because 
it can be the case that (i) the source is correlated, (ii) the source is ubiquitous since it is from 
wireless channel, and (iii) it is hard to eavesdrop because the wireless channel varies quickly in 
the spatial and temporal domains. This issue has received much attention in terms of theoretical 
and practical research lHI- 19]. However, most of this work is subject to the assumption that 
the eavesdropper channel is statistically independent of the main channel (the channel between 
Alice and Bob). This is true when the environment has rich scattering such that the correlation 
between channel coefficients decreases rapidly in the spatial domain. 

However, there is growing experimental evidence (e.g., [2(3-23]) and physical arguments (e.g., 
ll24l - l26ll ) which show that realistic wireless channels are sparse at large bandwidths. The effect 
of channel sparsity on secret key capacity is twofold: (i) it reduces the degrees-of-freedom (DoF) 
of the main (Alice-Bob) channel and (ii) it induces spatial correlation ||27|. thereby increasing 
Eve's ability to observe the main channel. 

We revisit the key generation problem when the channel exhibits sparsity in the wideband 
regime. This channel characteristic can be captured by a sparsity pattern that defines the non-zero 
support of the channel coefficients. Depending on the environment, the sparsity pattern could 
experience fast or slow time variations. The channel model also captures the correlation between 
the main channel and Eve's observations. To study secret key generation in this context we capture 
these characteristics by defining a state-dependent discrete multiple memoryless source (SD- 
DMMS). We specialize this model to the statistical characterization of sparse wireless channels 
were the sparsity pattern plays a role of the channel state and, as we discuss next, develop 
ergodic capacity and secrecy outage results. 

In analogy to communication over a fading channel, two regimes are studied according to the 
system delay constraint: 

• Ergodic regime (the delay tolerant regime): If the key is generated based on a large number 
of observations across multiple states, the secret key capacity is well-defined in the Shannon 
sense. We call the capacity in this case the ergodic secret key capacity. The main problem 
is that the system suffers from an excessive delay. 

• Non-ergodic regime (the delay stringent regime): If the observed source sequence is not 
long enough or the state changes slowly so that the key generation is forced to occur within 
a period of constant state, the capacity is not defined in general. In this case, we consider 
the secrecy outage probability which measures the probability that the instantaneous state 
condition cannot support the key rate to fulfill the secrecy condition (this will be defined 
later). 

Secrecy outage is also considered in other research regarding state-dependent (fading) wiretap 
channel (e.g., [|28L l29ll). We show that when a white sounding sequence is adopted in the wideband 
(low power) regime, a sparser channel can achieve a higher secret key rate than a richer channel 
can. This is analogous to capacity behavior in sparse multi-antenna channels in r[3Qh . Furthermore, 
at each signal-to-noise ratio (SNR), there is an adequate bandwidth that maximizes the secret 
key rate. For the outage performance, we show that the system can achieve an exponential 
decaying outage probability by using an a-backoff scheme (0 < a < 1) in which secret key rate 
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is a fraction a of the ergodic capacity. Unlike the ergodic case, now a richer channel always 
has a larger exponent characterizing the decay of the outage probability. In a similar vein as 
communication over a fading channel, this demonstrates that a large number of DoF helps to 
smooth out the effect of the unknown state. 

The paper is organized as following. In Section HI] we give some definitions and describe the 
system model. This includes the correlated sparse wireless channel model, the definition of the 
SD-DMMS, and the one-way discussion key generation protocol. In Section Hill we investigate 
the ergodic secret key capacity of SD-DMMS and apply this to key generation from a sparse 
wireless channel. Outage is defined in Section [TV] We give a necessary and sufficient condition 
for an outage event and explore the outage probability when an a-backoff scheme is used. 
Detailed proofs are deferred for the Appendix. 



II. Definitions and System Model 

In this paper we are motivated by key generation based on wireless channel that exhibits 
sparsity in the delay domain. We first develop our model of a sparse wireless channel in Section 



III-AI While in earlier works on modeling sparse wireless channels, e.g., see !120U 3ll-l35ll. there is 
only a single channel to model, in Section ITl-AI we need to model the main (Alice-to-Bob) channel 
as well as Eve's correlated observations of that main channel. Following our wireless motivations, 
in Section III-BI we develop an abstracted state-dependent discrete multiple source (SD-DMMS) 
model. In this model the "state" captures the effect of the slowly varying sparsity pattern while 
the key itself is extracted from the conditionally-generated (conditioned on the sparsity pattern) 
channel fades. Finally, in Section Hl-CI the one-way public discussion key generation protocol is 
formally presented. 



A. Sparse reciprocal wireless channel 

Consider a wireless communication system with bandwidth W . Say that the channel exhibits 
sparsity in the delay domain^ where r max is the maximum delay spread of the channel. Then 
L max = [r max jy] is the maximum number of resolvable paths. A sounding sequence d = 
[di, d 2 , • • • , djv d ] T is transmitted over time period T, where N d = \TW~\ . The sounding sequence 
is a known sequence with power d H d = P. We assume each two-way (Alice ^ Bob) sounding 
is done within a channel coherence period (i.e., T coh ^> 2T). Further multiple channel soundings 
(indexed by t) are performed within non-overlapping coherence periods meaning that each set 
of soundings are independent. 

The channel outputs in sounding interval t are 

X [t] = BH ab [t] + Wi [t] (Alice) , (la) 
Y[t] = BH ab [t] + W 2 [t] (Bob), (lb) 



where H ab [t] = (Hi [£],••• , H Lmax [t]) T is the sampled (virtual) channel coefficient B24j, 13611 



'in this paper, we consider channel sparsity in the delay domain. It is not difficult to extend the result to the sparsity in either 
the Doppler or spatial domains, e.g., 12414261 13511 . 
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vector, and D is an iV-by-L max Toeplitz matrix with N = N d 
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A widely used sounding signal is a sequence whose spectrum is asymptotically white in Nd. In 
this case D is a full column-rank matrix such thag 



D^D = PI 7 



(2) 



when N d is sufficiently large. One such example is d = \^Pe = yP(l, 0, • ■ ■ , 0) T . Another 
such example is pseudo-random (PN) sequence in spread spectrum system [371]. The noise terms 
Wi[t] and W 2 [i] in © are independent CM (0, ct^Iat) and d/V (0, ct&Ijv) vectors, respectively. 

1) Sparse channel model: Most channels that have a small number of physical paths will 
exhibit sparsity in the delay domain as the signal bandwidth W increases. In particular, in some 
delay bin £, the corresponding channel coefficient H e [t] will be zero. In this paper, we adopt 
the sub-linear law model considered in previous work 11341 13511 to capture the sparse channel 
characteristic. In this model, the channel is called 5-sparse if the average number of non-zero 
channel coefficients scales as 



L 



[Trr 



5e(0,l) 



(3) 



The parameter L is also the mean number of channel DoF. 

The channel sparsity pattern of the main channel in sounding interval t is 



S ab [t]=(s ab At],---,S ab , Lni Jt])eS 1 



where S = {0, 1} and E ^=1* <$WM = L. This pattern defines the support of the channel 
vector 

H ab [t] = (H^t}, H 2 [t] ...H Lni Jt]j, 

i.e., Hg[t] = if and only if S abj g[t] = 0. The channel coefficients H e [t} are independent 
CA/"(0,z^ 2 ) variable where the variance v\ = if S ab ^[t] = 0. The channel has unit power, 
i.e., J2e u e = !• L atei \ we use "channel degrees-of-freedom" (DoF) to refer to the weight of the 
realization of the vector S ab [t}. We also call S ab [t] the state of H ab [t). A rich multipath channel 
corresponds to S — > 1. 

The sparsity pattern S ab [t] will, in general, be time-varying. However, in most case of interest, 
S ab [t] will change much more slowly than the channel coefficients H ab [t]. This is because the 
main reflectors, by which paths are resolved by different dela y bi ns, move more slowly than the 
phase changes that influencs the fading coefficients 11361 l38l B9I1 . Because of this, most of the 
secret key rate will be generated by the randomness inherent to the channel coefficients rather 



2 Here and in the following, we say g(x n ) = g if g(x n ) — > g when n is sufficiently large. 
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than the sparsity pattern itself. Furthermore, there exists good techniques to estimate the sparsity 
pattern reliably based on few observations, e.g., lf40h . Thus, we consider S a b[t] known to Alice 
and Bob. Let n be the number of channel sounding periods during which the sparsity pattern 
remains constant. We term this the sparsity coherence period. Thus, the m-th sparsity coherent 
period extends from t — (m — l)n + 1 to t = ran. In this interval S a b[t} remains constant, i.e., 
S a b[t] = S a b[mn] for all t, (m— l)n+l <t< mn. We further assume that S a b[t] is independent 
across periods. 

Modeling the distribution of the state itself is a difficult task, so we consider a simple model 

Pr(S ab , e = 1) = = {r max W)-^ 4 p (4) 

"max 

for all t. In other words, the S a b,t is Bernoulli distribution with parameter p (denoted Bern (p)). 
2) Eavesdropper's correlation model: Eve's channel output is similar to (OQH: 

Z[t\ = DJT e [£] + W 3 [t] (Eve), (5) 



max L 



where the noise is CAf (0, ofl^). The channel coefficient vector H e [t] = (H e> i [t] , • • ■ , H e L 
is also 5-sparse with state denoted by S e [t], and each element CAf (0, vf) distributed. We model 
the correlation between H e [t] and H a b[t] in a two-step process as follows: 

. Correlation between S e and S ab : For each delay bin £ for which S ab / = 1, the probability 
that Eve also has non-zero channel gain is 9. i.e., 

Pr(S e/ = l\S ab/ = l) = 9 (6) 

for all 1 < I < L max . 

• Correlation between individual channel coefficient: For those channel coefficients in the 
"common support" delay bins, i.e., in the set {£ : S a b t e = S e ^ = 1}, the correlation 
coefficients are 

r}(He, h e/ ) - ? ======= - r] . 



e,£\ 

The parameter 9 captures the fraction of DoF that the main channel and Eve's channel have 
in common. One can think of the relationship between the state (sparsity pattern) of the main 
channel and that of the eavesdropper's observation as a binary memoryless channel. However, 
because Eve's marginal channel has the same <5-sparsity as the main channel (since the users are 
in the same environment), the channel is not symmetric. In other words, transition probability 
Pr(S e> e = l\S ab ,i = 0) ^ Pr(S^ = 0\S ab/ = 1). This is illustrated in Figure E Finally, the 
parameter 7] captures the effect that the paths (of both channel) located in the common delay 
bin shares the same physical scattering. 

Remark 1: The parameter space {(9, rj), 6} of our model captures many scenarios of interest. 
From a physical aspect, there are two factors effecting Eve's channel correlation: the distance 
between Eve and Bob (which mainly impacts leakage to Eve), and richness/sparseness of the 
multipath (which impacts both leakage to Eve and the common randomness between Alice and 
Bob). When Eve gets close to Bob, generally, both 9 and r\ will increase (and vice versa); 
this will generally increase the leakage. The parameter 5 (and thus p) controls the maximum 

3 In order to get meaningful observations, we assume Eve is located close to one of the users. So only one of the two Eve's 
channel outputs during the two-way sounding correlates with the main channel. The other output is independent of the main 
channel due to fast spatial decorrelation. 
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Fig. 1. Transition probability Pr(S e ,f \S a b,e)- 



number of DoF. When multipath is rich, p is high and i] is closer to zero (i.e., high overlap but 
independent), resulting in the highest capacity and lowest leakage. For sparse multipath, p is 
lower (lower common randomness) and i] could be large even at larger distances between Eve 
and Bob. In this case leakage will likely increase more slowly as Eve gets closer to Bob. 

To generate a secret key, users repeat the channel sounding (OQ) (and ©) nM times and 
generate a key based on a pair of super-block S a b[t]), (Y[t], S a b[t])}t^i- hi the following 

section we abstract away the actual sounding process and specify a state-dependent source model 
where the state varies more slowly than the underlying source-realization process from which 
the key is generated. When we study the ergodic case, we will let both n and M go to infinity, 
while when we study the outage case, M — 1, and n can be large. 



B. State-dependent discrete memoryless multiple source 

To leverage results on information theoretic security, we consider a state-dependent (SD) 
DMMS model depicted in Figure H The observation triple (X nM , Y nM , Z nM ) e X nM x y nM x 
Z nM is generated according to p(x nM , y nM , z nM \s^l, sf), conditioning on the pair of length-M 
sequences: {s^sf) e S M x S M . 

As discussed in Section III-Al is the state sequence of Alice and Bob's correlated source 
X nM X nM and S^ 1 is the state sequence of Eve's observation Z nM . The states have joint 
distribution p(s^f , s™). Since the states vary more slowly than the conditonally-generated sources, 
there is a length of time n during which the states remain constant. This correponds to the 
sparsity coherence period discussed earlier. A large n means that the states are changing slowly. 
We assume that the states are available to the corresponding observers but not to other users. In 
other words, Alice and Bob both know S a t but not S e while Eve knows S e but not S a b. This is 
depicted in Figure |2l We call the state memoryless if 

M 
m=l 

Similarly, the source is memoryless if 

M mn 

= ] P(Xi,yi,Zi\Sab,m,Se,m) ■ (8) 

m=l i=(m-l)n+l 
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Alice 



t nM nM nM i M M\ 

p(x ,y ,z \s ab ,s e ) 



Bob 



Eve 



Public channel 



Fig. 2. State-dependent DMMS model 



Note that in ® one see the effect of the sparsity coherence period. The triplet of source samples 
(Xi, Yj, Zi) is conditionally and independently generated from the same state pair (S ab:7n , S e:m ) 
for all i, (m — l)n < i < mn. Each of (Xi, Yi, Zi) stands for the vector of channel output in 

hes 

In the one-way discussion protocol (which will be detailed next in lll-CI) . Alice sends a message 
$ over a public channel. Bob recovers Alice's key based on his observation (Y nM , S%£) and $. 
Eve's source Z is a degraded version of Y if 

p(x, y, z\s ab , s e ) = p(x, y\s ab )p(z\y, s ab , s e ) . (9) 

In other words, for given states (s ab ,s e ), Eve's output is a cascade of the Bob's output and a 
channel represented by p(z\y, s ab , s e ). 



C. One-way discussion key generation protocol 

Let /C = [1 : 2 nR ] be the key space. There is an authenticated public channel available to users 
to exchange error-free public messages in the set $ = [1 : 2™^]. The one-way public discussion 
secret key generation protocol consists of three functions: 

/i : X nM x S M -> K , (10a) 
g : X nM x5 M ^$, (10b) 
f 2 : y nM x 5 A/ x $ /C , (10c) 

which define Alice's key, public message, and Bob's key, respectively. Namely, 

K = h{X nM ,S™) , (11a) 
(f> = g(X nM ,S%) , (lib) 
k = f 2 (Y nM ,S^,cP) . (11c) 
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Definition 1 (Achievability). A secret key rate R is (weakly) achievable if for any e > 0, there 
is a secret key generation system defined in (flOl) such that for sufficient large n and M, 



Pt(K^K)<€, (12) 
J(K;Z nM ,,S e M ,$) < e , (13) 



nM 

J M H { K)>R-e. (14) 

Condition ([141) means the key is almost uniformly distributed over the set /C. System secrecy 
is measured in terms of the mutual information defined in (fl"3l which says that the information 
about the key leaked to eavesdropper is negligible. The supremum of achievable secret key rates 
is called the secret key capacity. 



III. Ergodic Secret Key Capacity 

For applications that can tolerate longer delays, the key generation protocol can operate across 
a large number of independent state realizations. In this setting n and M can both be arbitrary 
large. The secret key capacity in the Shannon sense is well-defined and is termed the ergodic 
secret key capacity, C cr . 



A. Ergodic Capacity of SD-DMMS 

The theorems developed by Ahlswede, Csiszar [ll, Theorem 1] and Maurer [0, Theorem 1,2] 
can be applied to the ergodic case of the source model in Figure [2] to get the following lemma. 

Lemma 1. 

C~ < C eT < C+ , (15) 

where 

C~ = I(X; Y\S ab ) - I(X; Z, S e \S ab ) + -H(S ab \S e ) (16) 

n 

C+ = I(X; Y\Z, S ab , S e ) + -H(S ab \S e ) . (17) 

n 

Proof: The proof is given in Appendix |Al ■ ■ 
The important observation about (fT6l) and (flTl) is that they both consist of two types of terms: 
mutual information terms and entropy terms. The latter quantifies the amount of uncertainty in 
the sparsity pattern of the main (Alice-to-Bob) channel given Eve's observation S e . The former 
quantifies the conditional secret key capacity given the latter. The following lemma says that the 
upper and lower bound equal one another when the eavesdropper's observation is degraded. 

Corollary 2. For the situation in which the eavesdropper's source is degraded per ©, the 
ergodic secret key capacity is 

C CT = I(X; Y\S ab ) - I(X; Z, S e \S ab ) + -H(S ab \S e ) . (18) 
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Proof: It can be verified by examining ( fTTT ) that 

C+ = I(X; Y\Z, S ab , S e ) + ^H(S ab \S e ) 

— I(X; Y, Z, S e \Sab) — I(X\ Z, S e \S a b) H — H(S ab \S e 

n 

= I(X; Y\S ab ) - I(X; Z, S e \S ab ) + -H(S ab \S e ) 



n 



a 



er ' 



where the third equality is due to the fact that given S ab we have Markov chain X — Y — (Z, S e ). 
This holds since the eavesdropper is degraded. ■ 
Note that when the state changes slowly, which is equivalent to when n is large, -H(S ab \S e ) — > 
0. That is, the contribution to the secret key capacity due to the sparsity pattern S ab is very 
small. As discussed in Section III-AI this will be the common situation. Thus, in following, we 
focus on the non-vanishing term of (fT8l) . which we denote as R CT , i.e., R CT = I(X;Y\S ab ) — 
I(X; Z, S e \S ab ). 



B. Ergodic secret key rate of sparse wireless channel 

We now first apply Lemma Q] to the sparse channel model specified in III-AI In Section ITlI-B II 
we first examine the expressions for mutual information I(X; Y\S ab ) and I(X; Z, S e \S ab ) for 
the vector channel described by (OQ) and ©. Then, in Section IIII-B2I we identify conditions 
under which the eavesdropper's observation is degraded. Finally, in Sections IIII-B3I and IIII-B4I 
we focus in on the randomness due to the sparity patterns and analyze the wideband limit. 

1) Mutual information: Define Qi to be the product S abj £ x S e ^ so Qt e {0, 1}. Thus Qi = l 
if and only if the support (the sparsity pattern) of H ab and of H e are both non-zero in the £-th 
delay bin. Also define two functions: 



Iabha, 76) = log 
hdaile) = log 



and 7 a 



(l + 7a)(l+7t) 
1 + 7a + lb 

(l + 7 a)(l + 7e) 
l + 7a7e( 1 - l^| 2 )+7a + 7e 



■^2 and 7e = We show in Appendix |B] that 



(19a) 
(19b) 



I(X-Y\S nh ) = E 



I(X; Z, S e \S ab ) = E 



} J Sab/Iabi^la, v\lb) 



Qde(Vela,Vele 



(20a) 
(20b) 



In the above expressions, the expectation is taken over the random sparsity patterns S ab and S e . 
Note the factor Qg in (I20bl) . When S ab ,e = 1 but S e> t = the eavesdropper has no measurement 
of that channel coefficient (Q t = 0). Thus, the eavesdropper has no observation of that common 
randomness and the negative mutual information term in (fT6l) is zero. 

It is clear in (l20l) that channel sparsity patterns (S ab and S e ) effect the mutual information 
via the channel DoF (the number of terms in the summation) and the correlation coefficient r] 
effects the information leakage via J e (-) in each delay bin observed by the eavesdropper. 
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2) Degraded condition: Because the Eve's channel is correlated to the main channel, she 
may get a good estimation of H a b if she has a higher SNR than Alice and Bob. To guarantee 
the positivity of the secret key rate, we need to characterize the conditions under which the 
eavesdropper has a worse observation than Alice and Bob. To develop such conditions we first 
consider a delay bin where Qe = 10. Project the channel outputs onto d^, the £-th column of D, 
we get 

X t = dfX = PH e + W ljt (21a) 

Y e = dfY = PH e + W u . (21b) 

Because the sounding signal is an (asymptotically) white sequence, Xe (and Ye) are sufficient 
statistic for estimating He. The noise (resp. W^d is a zero mean complex Gaussian with 
variance Pa 2 a (resp. Pal). Similarly, Eve's sufficient static is 

Ze = dfZ = PH £ii + W 3/ 

= P (yVHi + v 7 ! - H 2 H^j + W 3/ . (22) 

Because of rj(He, H^i) = rj, we have equivalently written H e ^ as a sum of two terms. The 
first term is a scaled version of He- The second, H' £ , is a CM (0, vj) random variable that is 
independent of He. We see from (1221) that Eve's observation Ze contains two types of noise. The 
first is the receiver noise W 3> e. The second is due to the uncorrelated H' e . 

Eve's observation Z t will be a degraded version of Ye if Eve has a smaller SNR than Bob. 
This occurs if 



v}P 





\v 


\ 2 vjP 


(1-1 


v\ 


2 )vjP + o\ 



> T, . UT„ ; • (23) 



Otherwise, Ye is a degraded version of Ze. If the sounding signal power is small and Eve has a 
suitably smaller noise variance o\, in particular, when 



e 

2\„.2 D ^ I 1 2 u i 2 2 



(l-\rj^XP<\rj\^at-ai , (24) 
v i 

then Bob's output is noisier and no secret key can be extracted at a positive rate from the ^-th 
delay bin. This is because when P is small, Eve's independent noise (due to H' e ) is decreased. 
It is observed in Q4JJ] that there is a cutoff SNR below which the secret key capacity is zero. If 
v\ = vj and all the users (Alice, Bob and Eve) are with the same SNR, i.e., a\ = of = a 2 = a 2 , 
the secret key capacity will be positive because Eve has an extra noise (due to the uncorrelated 

H'e)- 

3) Achievable secret key rate: In order to see the effect of channel sparsity when the bandwidth 
is large (but finite), we focus on the equal-SNR case and consider a uniform delay profile, thus, 
having a degraded eavesdropper. Define the random number of non-zero channel coefficients in 
the main Alice-to-Bob and in Eve's channel to be, respectively, 

m ax 

B a b = ^ S a b,i , (25 a) 

^raax 

e=i 

4 In subspaces such that Qi = either S a b,l — or Eve has no observation of H a b.i, so there is no need to consider those 
subspaces. 
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Note that B ab and B e are binomial Bino(L max ,p) distributed random variables. Consider a 
uniform delay profile, i.e., v\ = -g— for all i for which S a b/ = 1; similarly, v\ = -J- for all I 
for which S e> e = 1. 

Let / S (-P) be the instantaneous key rate I(X; Y\S ab ) — I(X; Z, S e \S ab ) for fixed S a t and 
S e . i.e., 

' 1 7 \ T> T ( ^ 7 

M7J = £> a6-'a6 I 

where 7 = and 



J s ( 7 ) = B a6 / o6 -j- - B q I e (-J-, -J- ) , (26) 



B q = Qe (the number of overlap delay bins) . (27) 

From (l20l) and Corollary [2] the achievable secret key rate is 

I et (j)=E[I B (j)] . (28) 

As we will see later in IIII-B4L I s (7) is convex in low SNR (and so is / er (7)). Thus, a uniform 
sounding strategy using a sounding signal with constant power P is not optimal. Let V denote 
all sounding policies that satisfy average power constraint i?[d H d] < P, we can achieve 

Z2er( 7 ) = maxJer(7) ■ (29) 

Note that from Corollary [2] and the discussion thereafter, R CT (P) approaches C CT (P) from the 
below as n — > oo. 



Theorem 3 (An on-off sounding achieves capacity). 



i?er(7) = max XlerlVl ■ (30) 



o<a<i VA 

Proof: The proof is provided in Appendix |Cj ■ 

The physical interpretation of the auxiliary variable A is that key rate A/ cr can be achieved 

by an on-off sounding strategy that sounds the channel during A (0 < A < 1) fraction of the 



time, each with power j, and does not sound the channel (i.e., is turned off) during the rest of 
the time (i.e., a time-sharing scheme). Theorem [3] says that the ergodic secret key capacity can 
be achieved by an A* on-off sounding strategy where A* is the argumment maximizing (f3Qb . As 
we will discuss in IIII-B41 an optimal on-off signal is sparse in time (i.e., A* — > 0) in a low SNR 
(7 — > 0) and is dense (i.e., A* — > 1) in a high SNR. 

4) Wideband regime: One way to increase the secret key capacity is to increase the bandwidth 
W of the wireless channel. However, the channel DoF do not grow linearly in W. To see how 
W effects the secret key rate, we examine R eT (P) from (|3Q|) in the wideband regime. 

In this case, each channel DoF is sounded at a low SNR. At low SNR we can approximate 
G2J as 

I ab (x,x) w ^— , (31a) 
In 2 

/ e (x,y)«l^. (31b) 
In 2 
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25 

SNR (dB) 



Fig. 3. Achievable secret key rate 7 cr (7) plotted versus SNR (7). The bandwidth is W =100MHz, the maximum delay spread 
Tmax = lO^is, the conditional probability of overlap in S a b and Se is 9 = 0.5 and the correlation between channel coefficients 
is 77 = 0.1. The sparsity parameter S G [0.5, 1]. 



for x and y small. The ergodic key rate 



7 er(7) « TT^ J 



In 2 


B a b 


^\B a b, 


)'- 


B q 


I 12 7 7 

-Safe -Be 


-!—E 
In 2 


1 


-M 2 


B q 


1 " 




B a b 


B a b 


B e \ 





(a) 7 2 (1~%| 2 ) t 2 (1 - C?[77| 2 ) 

~ In 2 L ~ln2( W W0 5 



(32) 



The approximation (a) is accurate when L 3> 1 11421. eq.(5)]. The right hand side of (1321 is a 
quadratic function of 7, thus / or (7) is convex in low SNR. 

Figure |3] plots I er (7) versus 7, for a bandwidth of W = 100MHz, r max = 10/is, and for various 
values of the sparsity parameter 5 6 [0.5, 1]. We see that a sparser channel (small 5) achieves a 
higher key rate at low SNRs. We can also observe this from (|32l) . According to Theorem [3] and 
notice that (|32l is quadratic in 7, we need a sparser signal in time (an on-off signal) to get a 
higher key rate. In other words, in the wideband (power-limited) regime, fewer DoF (either in 
channel or in time domain) can achieve a higher key rate. This occurs because the key generation 
problem is a combined channel sounding and channel coding problem. By focusing energy on 
fewer DoF we raise their SNR, enabling key generation to occur at a higher rate. In contrast, a 
richer channel (large 5) results in a higher key rate at a high SNR since that is a DoF-limited 
(and not a power-limited) regime. 

Figure |4(a)| and |4(b)| plots J er as a function of W. This provides another view of the tradeoff 
between power and DoF. First, let 7 be fixed at lOdB. Then, Figure [4(a)] plots J cr for different 
values of channel sparsity 5 in the range [0.5, 1). In the wideband (low-SNR) regime, larger 8 
results in a smaller key rate. In Figure |4(b~)| 8 = 0.5 is fixed and 7 is varied from lOdB to 30dB. 
We see that for each SNR, there is a unique W* that achieves the highest key rate. 
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4.5 




Fig. 4. Achievable secret key rate I 01 -(7) for SNR fixed at 7 = WdB plotted versus bandwidth W. In subfigure |(a)| the tradeoff 
is plotted for for values of the sparsity parameter S £ [0.5, 1). In subfigure |(b)| the sparsity parameter is fixed at S = 0.5 and 
the tradeoff is plotted for four SNRs, 7 (dB) £ [15, 16]. 

IV. Secrecy Outage 

In contrast to Section [III] when an application has a stringent delay requirement or when the 
state (i.e., the sparsity pattern) changes so slowly that it is roughly constant during the secret 
key generation process, the secret key capacity in th Shannon sense is not well-defined. To study 
this setting, in this section we set M = 1 while allowing n to be arbitrary large. Since users only 
know their state but not Eve's state, they cannot adapt the key generation rate to Eve's state. 
Thus, satisfying the secrecy condition (TT3T) can be problematic. In this section, we consider an 
"outage" setting with a degraded eavesdropper. For any (M = 1) realization (S ab , S e ) = (s ab , s e ), 
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we say that a secrecy outage occurs if 

-I(K;Z n ,<$>\s ab ,s e ) >R e (33) 
n 

for some R e > 0. Namely, there is a non-vanishing information rate leaked to Eve. Let 

C s (s ab , s e ) = I(X; Y\s ab ) - I(X; Z\s ab , s e ) (34) 

be the conditional secret key capacity for state (s abl s e ). Theorem |4] shows that the event 
R > C s (s ab , s e ) is a necessary and sufficient condition for the outage event (|33~T) . 

Theorem 4. For any rate-R secret key generation systems for which Bob can reliability 
recover X n (i.e., Yi(X n ^ f 2 (Y n , s ab ,(f))) -> f or some f2{ )), and let 
Re{s a b, s e ) — R — C s (s ab , s e ) > 0, then 

( i) the information leaked to Eve is lower bounded as 

-I(K; Z n , $|s afe , s e ) > R e (s ab , s e ) - 2e , (35) 

and 

(ii) there exist a coding scheme (cf, (fTTI) ) that satisfies (fT2l) . (fT4l) and 

-I(K; Z n , $| Sab , s e ) < R e (s ab , s e ) + 2e . (36) 
n 

Proof: The proof can be found in Appendix [Ql ■ 

A. Wideband sparse channel 

In the reciprocal wireless channel case, we know from IIII-Bl that C s (S ab , S e ) = I s (j) given 
in (|26|) . Using the approximations from (I3TT) . we have in the wideband regime that 

C s (S ab , S e ) « ^- ( — - \v\ 2 —— ) • (37) 

Recall that B ab (resp. B e ) is the weight of vector S ab (resp. S e ) (cf., (|25l )) and B q is the weight 
of support common to S ab and S e (cf., (|27l)). Also note that B ab , B e , B q are random variables 
so that the overall quantity in (|37l ) is a random variable. Unfortunately, there is no simple 
expression for the distribution of C s (S ab , S e ) in (1371) . Since the users are assumed to know S ab 
(and, therefore, B ab ), in order to understand how the channel sparsity effects the probability of 
outage, we consider the case where B ab = L (i.e., its mean which is its most likely value) and 
B e = L. The only uncertainty at users is B q , the number of delay bins from which Eve can 
learn the key. Conditioned on B ab = L and according to the correlation model in ©, B q has a 
Binomial distribution Bino (L, 6). 

From Theorem HI the outage probability is 

P out = Pr( J R>C s (5 afc ,5 e )) 

r > ( i - y 2 ^ 

Lin 2 V L 
Pr(^>^(l-ln2^) ) , (38) 
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where L = (Wr maiX ) s . We see that a larger 7 (SNR), a larger W, or a smaller 77 will decrease 
the outage probability. However, the sparsity 5 changes both the distribution of B q and the right 
hand side of the argument in (1381) via L. Thus, it is still not clear how S impact P out . When 
users don't know the instantaneous secret key capacity, a conservative strategy is to generate a 
key at a smaller rate. 

Consider a strategy in which the key is generated at rate R = al er (j) (0 < a < 1), i.e., a 
backoff from the ergodic key rate (l32l) . We refer to this strategy as the "a-backoff" strategy. 
The outage probability (1381) can now be simplified to be 

P out « Pr (B q > aL) (39) 



where a = (1 — a) -—r^ + a6 . 

\T]f 



Since B q approximates Bino (L, 9), the sparsity 5 (and therefore the actual DoF L) determines 



the distribution of Eve's DoF B q to observe the main channel. From (1391 , we can see that when 
the a-backoff strategy is used, the correlation coefficient n determines how fast the threshold aL 
deviates from 9L (the mean of B q ) as a decreases. Note that in (l39l) . the SNR (or equivalently, 
power P) does not appear in the formula. This is because the key rate is proportional to ergodic 
key rate I cr {^), which is a quadratic function of 7 in the wideband regime (cf. (1321)), and thus 
cancels the •y 2 in (l38l) . 



We next use results from large deviation theory 114311 to upper bound the tail probability of 
binomial distribution. 



Lemma 5. [43, Theorem I] Let S n be a binomial random variable Bino (n,p). For p < a < 1, 
and for n = 1, 2, 3, • • •, then 

Pr(S n > an) < 2- nD{a{lp) (40) 

where 

D(a\\p) = a log - + (1 - a) log ^ ~ ^ (41) 
p 1 — p 

is the Kullback-Leibler divergence between the probability distributions Bern (a) and Bern (p). 
By this lemma, the outage probability is upper bounded as 

Pout < 2~ LD(a||e) . (42) 

Figure |5] plots the numerical results of the secrecy outage exponent LD(a\\6) in the wideband 
regime. It shows that when the a-backoff strategy is used, the mechanism through which the 
channel sparsity impacts the outage probability differs from how the channel sparsity impacts 
the ergodic secret key rate. A richer channel (larger 5) always has larger exponent than a sparser 
channel. In contrast, Figure [3] demonstrates a sparser channel yields a higher ergodic secret key 
rate in the wideband regime. 



V. Conclusions 

In this paper we study a setting in which two users desire to distill a common secret key 
based on the inherent randomness of a reciprocal wireless channel. Our particular interest is 
the effect of channel sparsity (e.g., in delay), which scales sub-linearly in signal bandwidth, on 
secret key generation. Channel sparsity affects the inherent randomness of the main channel and 
increases eavesdropper's observability of the main channel. Since channel sparsity is an important 
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Fig. 5. Plot of outage exponent LD(a\\0) vs. bandwidth W. Other parameters include the maximum delay spread r max = 100ns, 
the conditional probability of overlap in S a b an d S e is 6 = 0.5 and the correlation between channel coefficients is r\ = 0.1. 
The sparsity parameter 8 is plotted for various values between 0.5 < 5 < 1. 



characteristic of many real-world wireless channels and since it has such a large impact on secret 
key capacity, it is crucial to understand this interplay fully. This will help us to deliver secure 
communication systems with robust guarantees. 

We first consider the ergodic setting. In this setting, at each SNR there is an adequate bandwidth 
to maximizes the ergodic secret key rate. Moreover, when a white sounding sequence is adopted 
in the wideband (low-SNR) regime, a higher secret key rate can be achieved by a sparser channel. 

For channels whose sparsity changes relatively slowly, a secrecy outage measure of perfor- 
mance is adopted. If the key rate is a fraction a of the ergodic capacity, we show that richer 
channels always have larger exponents characterizing the decay of the outage probability. This 
result illustrates that a larger number of DoF can smooth out of the detrimental effects of an 
unknown eavesdropper state. 



Appendix 



A. Proof of Lemma \T\ 

Apply the results in |Q]], [Q] where, respectively, (X n ,S a b) are Alice's, (Y n , S^&lare Bob's, 
and (Z n , S e ) are Eve's observations. A lower bound on the ergodic capacity is (see 111 Theorem 
1], B, Theorem 3]) 



Cor — — 

n 



I(X n , S a b, Y n , S a b) — I{X n , Sab; Z n , S e 
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Using the chain rule and memoryless nature of the source model in © and ©, the first term 
can be reduced to 

t( yn q . \rn q \ 
1 [^ ? Dab, I , D a b) 

= I [Sab] S a b) + I{X n ] Y n , S a b\S a b) 



H(S ab ) + J2l(X i ;Y n \X i ~ 1 ,S ab ) 



(a) 



i=l 
n 



H(S ab ) + J2 I ( X ^ S ^ 



1=1 



= i/(5 a6 ) + n/(X ; y|5 Qb ) , 

where (a) follows by applying the memoryless property to source (X u Yj). Similarly, the second 
term reduces to 

I(X n , S a b] Z n , S e ) 

= I (S a b] Z n , S e ) + I(X n ] Z n , S e \S a b) 
n 

= I (S a b] S e ) I(Xi] Z n , S e \X l 1 ,S t ^ 

i=l 
n 



ah J 



I (S a b] S e ) + I(Xi] Zi, S e \S a b) 



i=l 

= I(S ab ] S e ) + nI(X; Z, S e \S ab ) , 

where (b) is due to the Markov chain S ab — S e — Z n and applying chain rule on the second term. 
Thus, the lower bound is 

C~ = I(X; Y\S ab ) - I(X; Z, S e \S ab ) + ^H(S ab \S e ) . (43) 
The upper bound is the conditional mutual information (see |d Theorem 1], 10, Corollary 1]): 

Ccr = —I(X ,S ab ]Y , S a b\Z , S e ) 
n 



— (l(Sab] Y n , S ab \Z n , S e ) 

n \ 

+ I(X n ; Y n , S a b\Z n , S e , S a b 

< -(H(Sab\Z n ,S e ) 
n \ 

n 

J2nX l ]Y n \X^ 1 ,Z n ,S e ,S ab )) 
i=i 

n 

(H(S ab \S e ) + J (X t ] Y\Z U S e , S ab )) 



n 

+ 

i=l 

(c) 1 



i=l 

= I(X;Y\Z,S ab ,S e ) + -H(Sab\S e ) , 

n 

where (c) follows by Markov condition S a b — S e — Z n and the memoryless property. 



18 



B. Derivation of mutual information ( |20l) 
First consider I(X; Y\S ab ): 

I(X; Y\S ab ) 



E[h(X\S ab ) - h(Y\S ab ) - h(X,Y\S ab )] 



E 



log 



det(Rx) • det(R K } 



(44) 



det(Rxy) 

where h(X) is the differential entropy [44] of X, and the expectation is taken over the distri- 
bution of S ab . Let Rx denote the co variance matrix of X when the input S ab = S is fixed, 
i.e., 



R x = E[XX H \S] = DR h D + a(l K 
where R h = diag(z/f, • • • , v\) and v\ = if Si = 0. Similarly, 



R Y = DR h D H + a 2 2 l N 



R 



XY 



Rx 


DR h D H 


DR h D w 


Ry 



We simplify the determinants as follows, 

det(Rx) = det(DR h D H + afl N ) 

DRhD^ 



[o?) N det ( I N 



0i 



( a ) / 2\N 



at) 1 " det II + 



AD^DA 



0"T 



(b) 



>f) K n(i+^?) 



2\N 



n 

!:5 i= l 



P 

1 + ~^V, 



a 



2"t 



where (a) follows by defining A = VRh an d applying Sylvester's determinant formula: det(I m + 
AB) = det(I n + BA) where A is an m-by-n matrix, and B is an n-by-m matrix. Step (b) is 
due to 0. Similarly, we find that 



det(Rj 



[<T. 



2\N 



n 

l:S,=l 



P , 
1 + -zVi 



det(Rxr) = {a 2 A) N J] 

t:S.=l 



(a 2 + a 2 )P 



2 2 



2J i? 



Substituting into (|44l . we get (I20al) . 

Follow a similar calculation, we get I(X; Z, S e \S ab ) in (|20b| ) by noting that 



R 



Rx 


DR h hD" 


. DR h hD" 


Rz 



where R h j 1 is a diagonal matrix and its ^-th diagonal element is equal to rju 2 if Qe = I or is 
equal to zero if Q t = 0. 
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C. Proof of Theorem \3\ 

The proof is similar to ifiol Theorem 4]. First note that ^(7) is non-decreasing in 7 and 
so is I C r(l)- This can be verified by evaluating dI ^J , which is non-negative. Define / or (7) = 
max 0<A <! A/ cr (^) . Note that I er (7) is a concave and non-decreasing function of 7. We are going 
to show Ter (hH is equal to R er (^) defined in (|29l) over the average power constraint P. Let 
V be the set of all sounding policies satisfying average power constraint P. Specifically, let 
the sounding policy in V allocate power P s to sounding signals with probability p(s) such that 
E[Ps] = Y, s P( s ) p s ^ P- Note mat ^cr (J?) > -L (^)- We can also upper bound 



Rcr (5) = m ^J2p^ (§) 

< max 

s 



0<A<1 V Act 2 



max XL 



max 
v 



< maxi r ' 



V " \ a 2 



(6) / P 

< /or 



a 2 

where (a) and (6) are due to the concavity and non-decreasing function of -T er (7)- 

D. Proof of Theorem 

We first show the lower bound and then the upper bound. 
1) Lower bound (|35T) / 

L(K; Z n ,<S>\s ab ,s e ) 

= H(K\s ab ,s e ) - H(K\Z n ,$,s ab ,s e ) 

= H(K\s ab , s e ) - [H(K, $\Z n , s ab , s e ) - H($\Z n , s ab , s e )] 

> H(K\s ab ,s e ) + H($\Y n ,s ab ,s e ) 

- [H(X n , K, $\Z n , s ab , s e ) - H(X n \L<, $, Z n , s abl s e )\ 

> n(R - e) + H($\Y n , s ab , s e ) - H(X n \Z n , s abl s e ) 
= n(R - e) + H($\Y n , s ab , s e ) - H(X n \Y n , s ab , s e ) 

+ H(X n \Y n , s ab , s e ) - H(X n \Z n , s ab , s e ) 

i n ( R _ e ) _ F n , s a6j Se ) - nC s (s a6 , s e ) 

(d) 

> n(R- C s (s ab ,s e ) - 2e) , 

where (a) is due to the fact that given (s ab , s e ), $ — X n — Y n — Z n form a Markov chain. Thus 
H(&\Z n , s abl s e ) > H(&\Y n , s ab , s e ). (b) holds because entropy is non-negative and (K,$) 
is function of (X n ,s ab ), we can take K, $ away from H(X n , K, §\Z n , s ab , s e ). For the same 
reason, we can add $ in H(X n \Y n , s abl s e ) and use chain rule to get (c). (d) is due to the 
reliable condition Pr(X n ^ f2(Y n , s ab , $))—)■ by applying Fano's inequality [44]. 
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2) Upper bound (|36l) : 

I(K; Z n ,<S>\s ab ,s e ) 

= H(K\s ab ,s e ) - H(K\Z n ,$,s ab ,s e ) 

<nR-H{K\Z n ,<5>,s ab ,s e ) 
because K G [1 : 2 ni? ]. We need to show there exist a coding scheme such that 

-H(K\Z n , $, s afe , s e ) > C s (s ab , s e ) - 2e . (45) 
n 

We will use the following lemma in the proof. 

Lemma 6. (cf. /0 ^.(25)7 /tUl ^.(itf^ Any e > 0, if ±#($|s a6 ,s e ) > H(X\Y,s ab ) + e, 
there exists a coding scheme where /2(-) and fs(-) are the decoding functions at Bob and Eve, 
respectively, such that for sufficiently large n, 

(i) Pr(X n ^f 2 (Y n ,s ab ,<!>))^0 , 

(ii) ±H(X n \K,$,Z n ,s ab ,s e ) < e . 

The proof of Lemma [6] uses a random coding technique to show existence. The first statement 



is exactly the Slepian-Wolf theorem I146ll . The second statement is the standard equivocation 



analysis which says if Eve knows K and $ along with her observation Z n , she can recover 



sequence X n . We refer to [|11L |45|] for the details. 

Adopting the coding scheme in Lemma [6] where the public message $ G [1 : 2 n( - H ( x \ Y,Sab ^ + ^]. 
We prove (|45T) through a sequence of (in)equalities: 

H(K\$,Z n ,s ab ,s e ) 

= H(X n , K\$, Z n , s ab , s e ) - H(X n \K, $, Z n , s abl s e ) 

> H(X n ,K\<5>,Z n ,s ab ,s e )-ne 

= H(X n , K, $\Z n , s ab , s e ) - H($\Z n , s ab , s e ) - ne 

= H(X n \Z n , s ab , s e ) - H($\Z n , s ab , s e ) - ne 
>H(X n \Z n ,s ab ,s e )-H($)-ne 

> H(X n \Z n , s ab , s e ) - nH(X\Y, s ab ) - 2ne 
= n(H(X\Z, s ab , s e ) - H(X\Y, s ab ) - 2e) 

= n(C s (s ab , s e ) - 2e) , 

where (a) is due to (ii) of Lemma [6l (6) follows because (K, $) is a function of (X n ,s a &). 
(c) comes from the fact that $ G [1 : 2 n ^ H ^ x ^ Y ' Sab ^ + ^] and the entropy is upper bounded by a 
uniform distribution. This completes the proof. 
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